The OpenVPN process exits unexpectedly when using the DCO kernel module #542
Comments
|
Thanks for the report! My guess is that DCO is not finding the peer to install the key for. |
|
note: I am deleting your post in the ovpn-dco ticket to avoid confusion. |
ordex
changed the title
|
note2: I changed the title as this is not an actual crash, but just a fatal condition leading to unexpected (but graceful) exit |
|
I would say this is issue is two-fold:
|
kEu3lWPoZ8XRv1O3hEt5xSQQJM0TvH2k
pushed a commit
to kEu3lWPoZ8XRv1O3hEt5xSQQJM0TvH2k/openvpn
that referenced
this issue
Apr 23, 2024
kEu3lWPoZ8XRv1O3hEt5xSQQJM0TvH2k
added a commit
to kEu3lWPoZ8XRv1O3hEt5xSQQJM0TvH2k/openvpn
that referenced
this issue
Apr 23, 2024
@ordex As far as I understand, the error when initializing the key context is primary, since nothing unusual happens in the The OpenVPN process itself is being completed, the operation of the The issue contains logs from
Example of an OpenVPN logs during a crash (#2): |
|
@kEu3lWPoZ8XRv1O3hEt5xSQQJM0TvH2k I was hoping to get an earlier log from OpenVPN (not kernel/ovpn-dco log) that shows the full connection of the client (when also the dco_new_peer is invoked). |
|
as you can see at the very beginning of the dmesg log: edit: the message above is printed at 16:05:28, which is earlier than the error showing up in openvpn at 16:05:34 |
|
@ordex I will try to provide all the necessary information as soon as possible. |
|
Good afternoon, @ordex ! Thank you for waiting. 🤝 Here are the complete logs from the moment the client connects before the OpenVPN process ends. I can assume that you may be interested in earlier logs using such a peer id. If so, please write. I will try to provide all the necessary information. |
|
Yeah, I wanted to find the related dco_new_peer call, normally happening after connection. Indeed it'd be interesting to see any past log related to peer-id=465, possibly also from dmesg. Thanks a lot for all this! |
|
Thanks for the reply, @ordex. I will try to send you the logs tomorrow (April 25th). |
|
Good afternoon, @ordex! Thanks for waiting. I've prepared the information you requested. There are filtered samples from openvpn.log (OpenVPN service logs) and kern.log (kernel logs). Filtering was performed by the peer ID starting at midnight and ending with the fall of OpenVPN. I have tried to keep as much relevant information as possible. Here they are: Is there anything else I can do to help? |
|
Thanks a lot! This looks interesting. |
|
Good afternoon, @ordex! Can you tell me, please, if there is any news? Thanks! |
|
Sorry, not yet. I'm quite busy with the upstream submission and I haven't had time to dig deep enough. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Good afternoon!
We encountered such a problem on our installation of an OpenVPN server using the DCO core module.
The problem causes the OpenVPN process to crash with disconnecting of all clients connected to OpenVPN. The problem is critical in the conditions of production.
Initial issue's comment inside the ovpn-dco repository: OpenVPN/ovpn-dco#50 (comment)
To Reproduce
Expected behavior
The OpenVPN process does not crash due to a single client's key context initialization error.
Version information (please complete the following information):
2.6.3-1 (deb12u2).Debian Bookworm (v12.5).masterfrom2024.04.16).
Additional context
Example of an OpenVPN logs during a crash (#1):
Example of an OpenVPN logs during a crash (#2):
Crash reason:
openvpn/src/openvpn/ssl.c
Line 1361 in 32e6586
^
M_FATALcauses the process to crash after an unsuccessful attempt to install key material in the DCO module.Confirmation:
https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/error.h#L142
^ Calling the
msg()procedure with theM_FATALflag results in an emergency (code1) shutdown of the process.Problem fixing scheme:
M_FATALflag withM_WARNin the problem source code locationinit_key_contextsprocedure into a function that returnsboolfalseinsideinit_key_contextin case of failure, otherwise returntrueinit_key_context, the case of returningfalse(failed initialization of the key context)Patch with fix (spot):
diff.patch
Patch with fix (full):
full_diff.patch
dmesglogs before fixing:OpenVPN logs after correction:
dmesglogs after fixing:Please pay attention to this problem. I will monitor this issue and respond if necessary.
Thanks!
The text was updated successfully, but these errors were encountered: